Google Cloud Organization Policy Terraform Module

This Terraform module makes it easier to manage organization policies for your Google Cloud environment, particularly when you want to have exclusion rules. This module will allow you to set a top-level org policy and then disable it on individual projects or folders easily.

Compatibility

This module is meant for use with Terraform 0.13+ and tested using Terraform 1.0+. If you find incompatibilities using Terraform >=0.13, please open an issue. If you haven't upgraded and need a Terraform 0.12.x-compatible version of this module, the last released version intended for Terraform 0.12.x is v4.0.0.

Usage

Many examples are included in the examples folder, but simple usage is as follows:

module "org-policy" {
  source            = "terraform-google-modules/org-policy/google"
  version           = "~> 3.0.2"

  constraint        = "constraints/serviceuser.services"
  policy_type       = "list"
  organization_id   = "123456789"
  enforce           = true
  exclude_folders   = ["folders/folder-1-id", "folders/folder-2-id"]
  exclude_projects  = ["project3", "project4"]
}

Variables

To control module's behavior, change variables' values regarding the following:

constraint: set this variable with the constraint value in the form constraints/{constraint identifier}. For example, constraints/serviceuser.services
policy_type: Specify either boolean for boolean policies or list for list policies. (default list)
Policy Root: set one of the following values to determine where the policy is applied:
- organization_id
- project_id
- folder_id
exclude_folders: a list of folder IDs to be excluded from this policy. These folders must be lower in the hierarchy than the policy root.
exclude_projects: a list of project IDs to be excluded from this policy. They must be lower in the hierarchy than the policy root.
Boolean policies (with policy_type: "boolean") can set the following variables:
- enforce: if true or null then the policy is enforced at the root; if false then policy is not enforced at the root. (default null)
List policies (with policy_type: "list") can set one of the following variables. Only one may be set.
- enforce: if true or null then policy will deny all; if false then policy will allow all (default null)
- allow: list of values to include in the policy with ALLOW behavior. Set enforce to null to use it.
- deny: list of values to include in the policy with DENY behavior. Set enforce to null to use it.
List policies with allow or deny values require the length to be set (a workaround for this terraform issue)
- allow_list_length
- deny_list_length

Inputs

Name	Description	Type	Default	Required
allow	(Only for list constraints) List of values which should be allowed	`list(string)`	[ "" ]	no
allow_list_length	The number of elements in the allow list	`number`	`0`	no
constraint	The constraint to be applied	`string`	n/a	yes
deny	(Only for list constraints) List of values which should be denied	`list(string)`	[ "" ]	no
deny_list_length	The number of elements in the deny list	`number`	`0`	no
enforce	If boolean constraint, whether the policy is enforced at the root; if list constraint, whether to deny all (true) or allow all	`bool`	`null`	no
exclude_folders	Set of folders to exclude from the policy	`set(string)`	`[]`	no
exclude_projects	Set of projects to exclude from the policy	`set(string)`	`[]`	no
folder_id	The folder id for putting the policy	`string`	`null`	no
organization_id	The organization id for putting the policy	`string`	`null`	no
policy_for	Resource hierarchy node to apply the policy to: can be one of `organization`, `folder`, or `project`.	`string`	n/a	yes
policy_type	The constraint type to work with (either 'boolean' or 'list')	`string`	`"list"`	no
project_id	The project id for putting the policy	`string`	`null`	no

Outputs

No output.

Requirements

Terraform plugins

Terraform >= 0.13.0
terraform-provider-google >= v2.5.0

Permissions

In order to execute this module, the Service Account you run as must have the Organization Policy Administrator (roles/orgpolicy.PolicyAdmin) role.

Install

Terraform

Be sure you have the correct Terraform version (0.12.x), you can choose the binary here:

https://releases.hashicorp.com/terraform/

Terraform plugins

terraform-provider-google >= v2.5.0

Fast install (optional)

For a fast install, please configure the variables on init_centos.sh or init_debian.sh script and then launch it.

The script will do:

Environment variables setting
Installation of base packages like wget, curl, unzip, gcloud, etc.

License

dmorellet/terraform-google-org-policy

ErrorLooks like something went wrong!

About

Resources

License

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Languages

Error
Looks like something went wrong!

Packages